Risk
A stolen session identifier can allow an attacker to act as an authenticated user.
Java
Settings and priorities
| Technology / priority | Parameter or mechanism | Setting and purpose |
|---|---|---|
| Java Standard | SystemCookiesDataProtection | true Sets HttpOnly for system cookies. |
| Java Standard | SystemCookiesHTTPSProtection | true for HTTPS connections Sets Secure for session and load-balancing cookies. |
How to verify
- Check HTTP Service and Web Container properties.
- Verify cookie flags in a real HTTPS connection.
- Review redirects and TLS termination.